Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ACME v2 and Wildcard Certificate Support is Live

community.letsencrypt.org

Post reply on HN
Print view View original

141–150 of 321 posts

Re: ACME v2 and Wildcard Certificate Support is Live

#141

Post by EvanAnderson »

Jaruzel wrote: post #111
EvanAnderson wrote: post #98

Earlier quoted context omitted.

The ".local" suffix was a terrible idea, to be sure. Active Directory domain rename in small environments is relatively painless.

Unless of course, you are running Exchange. In which case it's not supported :(

Unfortunately, yes. I've been lucky enough to be able to get domain renames done in Exchange 2003 environments (which is supported) or in non-Exchange environments. Migrating to a new domain because of a poorly-chosen name is a real pain. (I have one Customer who has a "." in their NetBIOS domain name. That creates some interesting kinds of hell-- completely breaks the NPS RADIUS server in Windows 2012.)

Re: ACME v2 and Wildcard Certificate Support is Live

#143

Post by Karunamon »

Jaruzel wrote: post #116
16bytes wrote: post #105

Earlier quoted context omitted.

Can you outline the approach how this would work? It was my understanding that in order to use Let's Encrypt you needed a public facing server to verify ownership.

For the standard LE certs, you need a public facing web server for the domain name in question, and LE give you a keyfile to put into: '/.well-known/pki-validation' For the wildcard certs, you just need to add a TXT record to the public DNS entry, no public web server required. Even if you have no intention of using your internal DNS domain name on the internet, it's good practice to register it anyway.

Is there a "standard" TLD for internal use that will also fit this requirement?

The problem here is that there's no such thing as domain ownership, only domain renting. You forget to pay your bill (read: someone loses an email) and a core part of your infrastructure is up in smoke, or worse, taken over by a squatter.

Re: ACME v2 and Wildcard Certificate Support is Live

#145

Post by beavis2 »

eric_b wrote: post #65
ancarda wrote: post #62

Earlier quoted context omitted.

I wrote that in anger, and almost right away removed it when I calmed down. Please see my current comment.

But why did it make you so angry? My guess is because my viewpoint is completely unfathomable to you. You can't even believe that someone would advocate for it. In situations like that, I always try and put myself in the shoes of that person. Sometimes they are wrong, and sometimes they have a point. But it's always a useful exercise. To your parent comment - No, I don't think it's a cabal of "grumpy old men" - I thi…

Honestly, from not ever using nginx to having an auto-renewing "A+" HTTPS site took no longer than 3 hours.

Re: ACME v2 and Wildcard Certificate Support is Live

#146

Post by amaccuish »

Jaruzel wrote: post #80
Jaruzel wrote: post #74

One of the wonderful aspects of this, that no-ones pointed out yet, is that these can used for INTERNAL domains, without you having to run your own internal CA. i.e. lets say your internal network DNS domain is 'my-company-lan.com' - all you have to do is ensure that 'my-company-lan.com' is also registered in public DNS[1], and then you can secure ALL your internal services using a free LE wildcard cert, that's autom…

Going to reply to my own comment here. It's at this point that I swear profusely at Microsoft yet again, for pushing the concept of '.local' domain suffixes a decade ago. As it's not a legal TLD, I can't get certs for any of my internal services without rolling my own internal CA, which only works automatically for Windows domain machines, and not for anything else.

And also conflicts with mdns. :(

Re: ACME v2 and Wildcard Certificate Support is Live

#147

Post by jdmulloy »

floatboth wrote: post #87
JankySolutions wrote: post #47

Earlier quoted context omitted.

They are not the only CA that issues certificates for free. For example, AlwaysOnSSL[0] was on HN a few days ago[1], with some important differences (as pointed out in the HN comments) [0] https://alwaysonssl.com/ [1] https://news.ycombinator.com/item?id=16566031

Also, https://aws.amazon.com/certificate-manager/

It's a very nice feature, but you can't actually get the cert to use on your own servers or devices. You can only use it with AWS services, like their load balancers and Cloudfront. It makes a lot of sense that they do it this way, it makes it very easy to keep secure, since you never get the key. However it doesn't solve the same problems that Let's Encrypt does, and that's ok.

Re: ACME v2 and Wildcard Certificate Support is Live

#148

Post by web007 »

orthecreedence wrote: post #24
kardos wrote: post #19

Earlier quoted context omitted.

Not sure how the availability of wildcard certs changes that scenario, if I can set the DNS record for secure-payments.yourbusiness.com then I can get a non-wildcard cert for it and get on with the spamming straight away

I think it's somewhat difficult to get a valid (CA-valid) certificate for a domain you don't own, though. At least, that's what the job of the CAs is: to verify that the certs they're issuing are for the actual owner of yourbusiness.com.

I thought that was the case, until CloudFlare issued a cert for a subdomain of mine without a single email round-trip or even notification.

Any DNS-based validation is contingent on full DNS control, and that does mean FULL. CNAME records are absolute, if I CNAME foo to xyz then I'm trusting xyz 100%. I won't get an email round-trip or CAA ping for the certificate unless I'm looking for it, because CNAME implies that all things that apply to xyz apply to anything pointed at it. So the CAA record for xyz applies, not the CAA record for foo - it's not even valid to have any other record types for the same name as a CNAME record, and CAA resolution stops if it gets a valid response versus walking up to the domain root.

To be clear: CloudFlare issued a perfectly valid certificate for a perfectly valid use case, it just bothers me that I couldn't tell it was issued until after-the-fact by seeing it in CT logs, and couldn't have prevented it from being issued by the mechanisms that seem to be built for that.

Re: ACME v2 and Wildcard Certificate Support is Live

#150

Post by amaccuish »

Manozco wrote: post #136
vertex-four wrote: post #94

Earlier quoted context omitted.

> We're right back to the same level of security of you just checking that the browser bar points at the domain you actually intended to go to. So you’re sitting in a cafe, and you go to Facebook.com. Lo and behold, someone’s installed a MITM proxy on the router, that presents its own encryption key instead of Facebook’s, and your browser has no way to tell this because the CA system isn’t a thing. They now have your…

Technically, certificates automatically validated only guarantees that you are on the website that let's encrypt thinks correspond to facebook.com. MiTM state wide could tamper with it

How so?
Post reply on HN